Privacy Policy

Last updated: September 2026

1. Introduction

SLM Link is a Communications Platform as a Service (CPaaS) that allows businesses to manage their messaging channels and social networks — including WhatsApp, Instagram, Facebook, Messenger, Threads and TikTok — from a single interface and unified API.

SLM Link operates as a Tech Provider under the Meta Platform Terms: our primary purpose is to enable our customers (tenants) to access and use the APIs of Meta Platforms, Inc. to manage their messaging and presence on social networks. We act in the equivalent capacity with respect to TikTok, under the TikTok Developer Terms of Service and the TikTok Content Sharing Guidelines.

This Privacy Policy describes how we collect, use, store, share and protect personal data, including data obtained through the Meta Platform ("Platform Data") and data obtained through the TikTok APIs, in compliance with:

• The Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) of Mexico.
• The Meta Platform Terms and Developer Policies.
• The TikTok Developer Terms of Service and the TikTok Content Sharing Guidelines.
• The General Data Protection Regulation (GDPR) of the European Union, where applicable.
• The California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), where applicable.
• Any other legislation applicable depending on the user's jurisdiction.

2. Data we collect

2.1 Data provided directly

• Registration data: name, email address, password (stored with Argon2id hashing), organization name.
• Billing data: Tax ID (RFC), legal name, tax address (where applicable).
• End-customer contact data: name, phone number, messages sent and received through the connected channels.

2.2 Platform Data — Data obtained through the Meta Platform

When our customers connect their business accounts through the OAuth flow managed by SLM Link, we obtain and process the following data from the Meta Platform ("Platform Data"):

2.3 Meta access tokens

When channels are connected, we obtain OAuth access tokens from Meta. These tokens are automatically exchanged for long-lived tokens and renewed in the background before expiration. Tokens are always transmitted over HTTPS/TLS and stored isolated per tenant, with access restricted to users of that same tenant holding channel administration permission. They are never exposed to the end user nor shared with third parties. When a channel is disconnected we stop using its tokens immediately and the record is archived; the tokens are purged when a permanent deletion is requested (see section 8). The tokens themselves remain valid at Meta until they expire, or stop working immediately if the account holder revokes our access from their own Meta settings — which is the fastest way to terminate our access.

2.4 Data collected automatically

• IP address, user agent (browser), access timestamp.
• Activity logs for auditing and diagnostics.
• Strictly necessary cookies for the operation of the platform.

2.5 Data obtained through TikTok

When our customers connect their TikTok account through the TikTok Login Kit OAuth flow managed by SLM Link, the account holder expressly authorises three permissions and no others: user.info.basic, video.publish and video.upload. With those, we obtain and process the following data:

What we do NOT obtain from TikTok. We list this explicitly because the absence of these permissions verifiably limits the scope of our access:

• We do not access comments on any publication. We do not read them, we do not store them, and we cannot reply to them or moderate them.
• We do not obtain performance metrics: no views, no likes, no shares. We do not request the permission that exposes them.
• We do not access the list of existing videos on the account, nor publications made before the connection, nor content published outside SLM Link.
• We do not access direct messages, followers, following lists or audience data.

2.6 TikTok access tokens

When the account is connected we obtain an access token, valid for 24 hours, and a long-lived refresh token. A background process renews the access token before it expires, so the tenant does not have to re-authorise the account every day.

These tokens are always transmitted over HTTPS/TLS, are stored isolated per tenant, and access to them is restricted to users of that same tenant holding channel administration permission. They are never shown to the TikTok end user and are never shared with third parties. When the account is disconnected we stop using them immediately, the record is archived, and we ask TikTok to revoke the token, so that it stops being valid at TikTok and not only in our systems. Tokens are purged when a permanent deletion is requested (see section 8.1). If that revocation cannot be completed — for example, if the same TikTok account is still connected in another workspace, where revoking would cut off a service nobody asked to stop — we stop using the token regardless and it expires on its own. Revoking access from your own TikTok settings remains the most direct route, because it takes effect instantly and does not depend on us.

2.7 Handling of the video file

TikTok requires receiving the video file itself, not a link to it. For that reason, when the tenant provides a video address, SLM Link downloads it to its own temporary storage, verifies that it is a valid video file, and transfers it to TikTok in chunks.

The file is deleted from our storage as soon as TikTok finishes receiving it, within the same publication process and without manual intervention. We keep no copy of the video. All that remains recorded is the address the tenant provided, the publication text, and the identifier TikTok returned.

3. Purposes of processing

Primary purposes (necessary)

• Provide the multichannel messaging and social network management service.
• Authenticate and authorize access to the platform.
• Process, send and receive messages through Meta APIs on behalf of the tenant.
• Publish content on social networks on behalf of the tenant, including videos on TikTok.
• Connect WhatsApp, Instagram, Facebook, Threads and TikTok accounts via OAuth.
• Generate reports, analytics and usage statistics for the tenant.
• Deliver real-time events to the webhook configured by the tenant.
• Comply with legal and regulatory obligations.
• Cooperate with audits and reviews required by Meta Platforms, Inc. and by TikTok.

Secondary purposes (optional)

• Send communications about service updates.
• Improve the user experience through aggregated and anonymized analysis of usage patterns.
• Provide technical support.

If you do not want your data to be used for secondary purposes, you can let us know at privacidad@slm.cloud.

4. Legal basis for processing

Under the LFPDPPP (Mexico)

• Informed, free and specific consent granted upon registration and acceptance of these terms.
• Contractual performance necessary to provide the contracted service.
• Legal obligation when Mexican laws so require.

Under the GDPR (where applicable)

• Article 6(1)(b): Performance of a contract to which the data subject is party.
• Article 6(1)(a): Consent of the data subject for secondary purposes.
• Article 6(1)(c): Compliance with a legal obligation.
• Article 6(1)(f): Legitimate interests of SLM to improve the service and ensure security, provided the rights of the data subject do not override them.

Under the CCPA/CPRA (where applicable)

SLM Link acts as a "Service Provider" under the CCPA with respect to personal data of California residents processed on behalf of our tenants. We do not sell or share (as defined under the CCPA) personal information of consumers.

5. Data transfer and sharing

Your data may be shared with the following recipients, under the conditions described:

We do not sell personal data or Platform Data to third parties.

We do not share Platform Data with third parties except in the circumstances described in this table, in compliance with Section 3.c of the Meta Platform Terms.

6. International data transfers

SLM Link operates infrastructure that may involve transferring data outside Mexico. When personal data is transferred to jurisdictions without an adequate level of protection:

• For EU/EEA data: We use the Standard Contractual Clauses approved by the European Commission (Decision 2021/914), Controller-to-Controller module.
• For UK data: We use the International Data Transfer Addendum approved by the ICO.
• For data from Mexico: We comply with LFPDPPP requirements for international transfers, including data subject consent where required.

7. Data subject rights

ARCO Rights (LFPDPPP — Mexico)

You have the right to:

• Access: know what personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Cancellation: request deletion of your data when no longer needed.
• Objection: object to the processing of your data for specific purposes.

Rights under the GDPR (where applicable)

If you are a resident of the EEA or the UK, you also have the right to: data portability, restriction of processing, and to lodge a complaint with a supervisory authority.

Rights under the CCPA/CPRA (where applicable)

If you are a California resident, you have the right to: know what personal information is collected, request deletion, and not be discriminated against for exercising your rights.

How to exercise your rights

To exercise any of these rights, send an email to privacidad@slm.cloud with your full name, a description of the right you wish to exercise, and documents that prove your identity. We will respond within a maximum of 20 business days (Mexico) or 30 calendar days (GDPR).

8. Data deletion

You can request the complete deletion of your data through any of these mechanisms:

• By sending an email to privacidad@slm.cloud.
• Through the deletion link provided by Meta (Data Deletion Callback).
• From your account settings within the platform.

Data will be deleted within 30 days from the request.

Additionally, we delete Platform Data in the following circumstances, in accordance with Section 3.d of the Meta Platform Terms:

• When retaining the data is no longer necessary for a legitimate business purpose.
• When the tenant ceases to operate or cancels their account.
• When Meta Platforms, Inc. requests it for user protection.
• When the end user requests deletion of their data or no longer has an account with the tenant.
• When required by applicable law or regulation.

8.1 Withdrawing consent and TikTok access

The TikTok account holder can withdraw access at any time, without contacting us and without giving reasons, through two independent routes:

• From TikTok. In the app: Profile → Settings and privacy → Security and permissions → Manage app permissions, select SLM Link and remove access. This is the route we recommend, because the holder exercises it directly with TikTok and it does not depend on us.
• From SLM Link. Any user of the tenant holding channel administration permission can disconnect the account under Accounts.

What happens when access is withdrawn. If you revoke from TikTok, our tokens are invalidated immediately and we lose any ability to publish to, or read data from, the account. If the account is disconnected from SLM Link, we stop using the tokens at once, archive the record, and ask TikTok to revoke them. Where that request cannot be completed — for example, if the same account is still connected in another workspace — the token stops being used on our side and expires on its own. Revoking from TikTok remains the most direct route, because it does not depend on us. Content associated with that account stops being displayed in SLM Link and is archived, so that if the holder later re-authorises the same account, their history reappears instead of being lost.

Permanent deletion. If, instead of archiving, you would rather we permanently delete the data obtained from your TikTok account, you can request it by writing to privacidad@slm.cloud from a verifiable address, or through the tenant that connected the account. We handle the request within the timeframes stated in this section.

Publications already made on TikTok are governed by TikTok's own policies and remain under the exclusive control of the account holder: they are deleted from TikTok, not from SLM Link.

9. Data retention

If a legal obligation requires retaining data for a longer period, we will retain only the data that is necessary and for the period required, keeping evidence of such requirement.

10. Data security

We maintain administrative, physical and technical safeguards designed to meet or exceed industry standards, in accordance with Section 6 of the Meta Platform Terms:

• Encryption in transit: HTTPS/TLS on all communications.
• Password encryption: Argon2id with random salt.
• Digital signatures: HMAC-SHA256 for webhooks and OAuth tokens.
• Data isolation: each tenant has its data completely separated (tenant isolation). Platform Data from one tenant is never mixed with another's.
• Auditing: detailed logging of every action and access.
• Access control: authentication via API key/secret validated in real time on every request.
• Vulnerability reporting: you can report security vulnerabilities to seguridad@slm.cloud.

11. Security incidents

In the event of a security incident involving unauthorized access, loss, alteration or disclosure of Platform Data, of data obtained through TikTok, or of any other personal data:

• We will notify Meta Platforms, Inc. as soon as possible, in accordance with the Meta Platform Terms.
• We will notify TikTok as soon as possible when the incident involves data obtained through its APIs, in accordance with the TikTok Developer Terms of Service.
• We will notify affected tenants without undue delay.
• We will notify the competent authorities when required by applicable legislation.
• We will initiate immediate remediation and cooperate with the affected platforms and the authorities as appropriate.

12. Cookies

We use only strictly necessary cookies for the operation of the platform (session authentication). We do not use tracking, advertising, or third-party analytics cookies.

13. Minors

SLM Link is not directed at individuals under 18 years of age. We do not knowingly collect data from minors. If we become aware that we have collected data from a minor, we will delete it immediately.

14. Prohibited practices

In compliance with Section 3.a of the Meta Platform Terms, SLM Link does not engage in, nor does it allow its tenants to engage in, the following practices with Platform Data. The same prohibitions apply to data obtained through the TikTok APIs:

• Discrimination based on personal attributes (race, ethnicity, religion, sexual orientation, etc.).
• Eligibility determinations (housing, employment, credit, insurance, government benefits).
• Surveillance of individuals, groups or events.
• Sale, licensing or purchase of Platform Data.
• Creation or enrichment of user profiles without valid consent.
• Attempts to decode, re-identify or de-anonymize Platform Data.

15. Changes to this policy

Changes will be published on this page with the updated date modified. If the changes are significant, we will notify registered tenants by email. Continued use of the platform after publication of changes constitutes acceptance of the updated policy.

16. Regulatory authority

• Mexico: The competent authority for personal data protection is the one determined by the legislation in force on the matter.
• European Union: EEA users may file complaints with the supervisory authority of their country of residence. The competent supervisory authority under the Meta Platform Terms is the Data Protection Commission of Ireland.
• United Kingdom: UK users may file complaints with the Information Commissioner's Office (ICO).

17. Contact